@yina-npm/openrouterx 0.4.28 → 0.4.31

package/app/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -0,0 +1,84 @@
+// Built-in node:sqlite adapter — available in Node >= 22.5.0.
+// No native build, no npm install. API mirrors betterSqliteAdapter.
+import { PRAGMA_SQL } from "../schema.js";
+
+const CHECKPOINT_INTERVAL_MS = 60 * 1000;
+
+export async function createNodeSqliteAdapter(filePath) {
+  // Suppress "ExperimentalWarning: SQLite is an experimental feature" from node:sqlite.
+  // Stable enough for production use as of Node 22.x (RC quality).
+  const origEmit = process.emit;
+  process.emit = function (name, data, ...rest) {
+    if (name === "warning" && data?.name === "ExperimentalWarning" && /SQLite/i.test(data.message || "")) {
+      return false;
+    }
+    return origEmit.call(process, name, data, ...rest);
+  };
+
+  // Dynamic import — fails on Node < 22.5 → driver.js falls back to sql.js
+  const sqlite = await import("node:sqlite");
+  const Database = sqlite.DatabaseSync;
+  const db = new Database(filePath);
+
+  db.exec(PRAGMA_SQL);
+
+  const stmtCache = new Map();
+  function prepare(sql) {
+    let stmt = stmtCache.get(sql);
+    if (!stmt) {
+      stmt = db.prepare(sql);
+      stmtCache.set(sql, stmt);
+    }
+    return stmt;
+  }
+
+  // Periodic WAL checkpoint to keep -wal/-shm small
+  const checkpointTimer = setInterval(() => {
+    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
+  }, CHECKPOINT_INTERVAL_MS);
+  if (typeof checkpointTimer.unref === "function") checkpointTimer.unref();
+
+  function gracefulClose() {
+    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
+    try { stmtCache.clear(); } catch {}
+    try { db.close(); } catch {}
+  }
+  const onShutdown = () => gracefulClose();
+  process.once("beforeExit", onShutdown);
+  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
+  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
+
+  return {
+    driver: "node:sqlite",
+    run(sql, params = []) {
+      const r = prepare(sql).run(...params);
+      return { changes: Number(r.changes ?? 0), lastInsertRowid: Number(r.lastInsertRowid ?? 0) };
+    },
+    get(sql, params = []) {
+      return prepare(sql).get(...params);
+    },
+    all(sql, params = []) {
+      return prepare(sql).all(...params);
+    },
+    exec(sql) { return db.exec(sql); },
+    transaction(fn) {
+      // node:sqlite has no transaction wrapper. Use SAVEPOINT for nested support.
+      const sp = `sp_${Math.random().toString(36).slice(2)}`;
+      db.exec(`SAVEPOINT ${sp}`);
+      try {
+        const r = fn();
+        db.exec(`RELEASE ${sp}`);
+        return r;
+      } catch (e) {
+        try { db.exec(`ROLLBACK TO ${sp}`); db.exec(`RELEASE ${sp}`); } catch {}
+        throw e;
+      }
+    },
+    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    close() {
+      clearInterval(checkpointTimer);
+      gracefulClose();
+    },
+    raw: db,
+  };
+}

package/app/src/lib/db/adapters/sqljsAdapter.js

@@ -0,0 +1,115 @@
+import fs from "node:fs";
+import initSqlJs from "sql.js";
+import { PRAGMA_SQL } from "../schema.js";
+
+let SQL = null;
+
+async function loadSql() {
+  if (SQL) return SQL;
+  SQL = await initSqlJs();
+  return SQL;
+}
+
+export async function createSqlJsAdapter(filePath) {
+  const SQLLib = await loadSql();
+  const buf = fs.existsSync(filePath) ? fs.readFileSync(filePath) : null;
+  const db = new SQLLib.Database(buf);
+  db.exec(PRAGMA_SQL);
+  // Schema is created/synced by migrate.js after adapter init
+
+  let dirty = false;
+  let saveTimer = null;
+  const SAVE_DEBOUNCE_MS = 100;
+
+  function persist() {
+    const data = db.export();
+    fs.writeFileSync(filePath, Buffer.from(data));
+    dirty = false;
+  }
+
+  function scheduleSave() {
+    dirty = true;
+    if (saveTimer) clearTimeout(saveTimer);
+    saveTimer = setTimeout(() => {
+      saveTimer = null;
+      if (dirty) {
+        try { persist(); } catch (e) { console.error("[sqljs] save failed:", e); }
+      }
+    }, SAVE_DEBOUNCE_MS);
+  }
+
+  function paramsObj(params) {
+    if (!params || (Array.isArray(params) && params.length === 0)) return undefined;
+    return params;
+  }
+
+  function run(sql, params = []) {
+    const stmt = db.prepare(sql);
+    try {
+      stmt.bind(paramsObj(params));
+      stmt.step();
+      const changes = db.getRowsModified();
+      const lastInsertRowid = db.exec("SELECT last_insert_rowid() as id")[0]?.values?.[0]?.[0] ?? null;
+      scheduleSave();
+      return { changes, lastInsertRowid };
+    } finally {
+      stmt.free();
+    }
+  }
+
+  function get(sql, params = []) {
+    const stmt = db.prepare(sql);
+    try {
+      stmt.bind(paramsObj(params));
+      if (stmt.step()) return stmt.getAsObject();
+      return undefined;
+    } finally {
+      stmt.free();
+    }
+  }
+
+  function all(sql, params = []) {
+    const stmt = db.prepare(sql);
+    try {
+      stmt.bind(paramsObj(params));
+      const rows = [];
+      while (stmt.step()) rows.push(stmt.getAsObject());
+      return rows;
+    } finally {
+      stmt.free();
+    }
+  }
+
+  function exec(sql) {
+    db.exec(sql);
+    scheduleSave();
+  }
+
+  function transaction(fn) {
+    const sp = `sp_${Math.random().toString(36).slice(2)}`;
+    db.exec(`SAVEPOINT ${sp}`);
+    try {
+      const result = fn();
+      db.exec(`RELEASE ${sp}`);
+      scheduleSave();
+      return result;
+    } catch (e) {
+      try { db.exec(`ROLLBACK TO ${sp}`); db.exec(`RELEASE ${sp}`); } catch {}
+      throw e;
+    }
+  }
+
+  function close() {
+    if (saveTimer) clearTimeout(saveTimer);
+    if (dirty) persist();
+    db.close();
+  }
+
+  // Flush on shutdown
+  const flush = () => { if (dirty) try { persist(); } catch {} };
+  process.on("beforeExit", flush);
+  process.on("SIGINT", flush);
+  process.on("SIGTERM", flush);
+
+  return { driver: "sql.js", run, get, all, exec, transaction, close, raw: db };
+}

package/app/src/lib/db/migrate.js

@@ -0,0 +1,248 @@
+import fs from "node:fs";
+import path from "node:path";
+import { LEGACY_FILES, DB_DIR, DATA_FILE } from "./paths.js";
+import { TABLES, buildCreateTableSql } from "./schema.js";
+import { MIGRATIONS, latestVersion } from "./migrations/index.js";
+import { getMetaSync, setMetaSync } from "./helpers/metaStore.js";
+import { makeBackupDir, backupFile, pruneOldBackups } from "./backup.js";
+import { getAppVersion } from "./version.js";
+import { stringifyJson } from "./helpers/jsonCol.js";
+
+// Marker file: prevents re-importing legacy JSON when user wipes data.sqlite.
+const MIGRATED_MARKER = path.join(DB_DIR, ".migrated-from-json");
+
+// Track per-adapter so reusing same adapter skips re-run, but new adapter (after reset) re-runs.
+const _migratedAdapters = new WeakSet();
+
+function readJsonSafe(file) {
+  if (!fs.existsSync(file)) return null;
+  try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return null; }
+}
+
+function isFreshDb(adapter) {
+  // Table _meta may not exist yet on truly fresh DB
+  try {
+    const row = adapter.get(`SELECT COUNT(*) as c FROM _meta`);
+    return !row || row.c === 0;
+  } catch {
+    return true;
+  }
+}
+
+// ─── Versioned migrations runner (skip-version safe) ─────────────────────
+function runVersionedMigrations(adapter) {
+  // Bootstrap _meta first so we can read schemaVersion
+  adapter.exec(buildCreateTableSql("_meta", TABLES._meta));
+
+  const current = parseInt(getMetaSync(adapter, "schemaVersion", "0"), 10) || 0;
+  const target = latestVersion();
+  if (current >= target) return { applied: 0, from: current, to: current };
+
+  const pending = MIGRATIONS.filter((m) => m.version > current);
+  let lastApplied = current;
+  for (const m of pending) {
+    adapter.transaction(() => {
+      m.up(adapter);
+      setMetaSync(adapter, "schemaVersion", m.version);
+    });
+    lastApplied = m.version;
+    console.log(`[DB][migrate] applied #${m.version} ${m.name}`);
+  }
+  return { applied: pending.length, from: current, to: lastApplied };
+}
+
+// ─── Auto-sync (additive only): add missing tables/columns/indexes ───────
+function syncSchemaFromTables(adapter) {
+  for (const [tableName, def] of Object.entries(TABLES)) {
+    // Create table if absent
+    adapter.exec(buildCreateTableSql(tableName, def));
+
+    // Diff columns
+    const existing = adapter.all(`PRAGMA table_info(${tableName})`);
+    const existingNames = new Set(existing.map((r) => r.name));
+    for (const [colName, colDef] of Object.entries(def.columns)) {
+      if (!existingNames.has(colName)) {
+        // SQLite ADD COLUMN restrictions: no PRIMARY KEY / UNIQUE w/o NULL ok.
+        // We strip PRIMARY KEY / UNIQUE since those are only valid at create time.
+        const safeDef = colDef
+          .replace(/PRIMARY KEY( AUTOINCREMENT)?/i, "")
+          .replace(/UNIQUE/i, "")
+          .trim();
+        try {
+          adapter.exec(`ALTER TABLE ${tableName} ADD COLUMN ${colName} ${safeDef}`);
+          console.log(`[DB][sync] +column ${tableName}.${colName}`);
+        } catch (e) {
+          console.warn(`[DB][sync] add column ${tableName}.${colName} failed: ${e.message}`);
+        }
+      }
+    }
+
+    // Indexes (idempotent)
+    for (const idx of def.indexes || []) {
+      try { adapter.exec(idx); } catch {}
+    }
+  }
+}
+
+// ─── Legacy JSON import (one-time) ───────────────────────────────────────
+function importLegacyMain(adapter, data) {
+  if (!data || typeof data !== "object") return;
+
+  if (data.settings) {
+    adapter.run(`INSERT INTO settings(id, data) VALUES(1, ?) ON CONFLICT(id) DO UPDATE SET data = excluded.data`, [stringifyJson(data.settings)]);
+  }
+  for (const c of data.providerConnections || []) {
+    const { id, provider, authType, name, email, priority, isActive, createdAt, updatedAt, ...rest } = c;
+    adapter.run(
+      `INSERT OR REPLACE INTO providerConnections(id, provider, authType, name, email, priority, isActive, data, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [id, provider, authType || "oauth", name || null, email || null, priority || null, isActive === false ? 0 : 1, stringifyJson(rest), createdAt || new Date().toISOString(), updatedAt || new Date().toISOString()]
+    );
+  }
+  for (const n of data.providerNodes || []) {
+    const { id, type, name, createdAt, updatedAt, ...rest } = n;
+    adapter.run(
+      `INSERT OR REPLACE INTO providerNodes(id, type, name, data, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?)`,
+      [id, type || null, name || null, stringifyJson(rest), createdAt || new Date().toISOString(), updatedAt || new Date().toISOString()]
+    );
+  }
+  for (const p of data.proxyPools || []) {
+    const { id, isActive, testStatus, createdAt, updatedAt, ...rest } = p;
+    adapter.run(
+      `INSERT OR REPLACE INTO proxyPools(id, isActive, testStatus, data, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?)`,
+      [id, isActive === false ? 0 : 1, testStatus || "unknown", stringifyJson(rest), createdAt || new Date().toISOString(), updatedAt || new Date().toISOString()]
+    );
+  }
+  for (const k of data.apiKeys || []) {
+    adapter.run(
+      `INSERT OR REPLACE INTO apiKeys(id, key, name, machineId, isActive, createdAt) VALUES(?, ?, ?, ?, ?, ?)`,
+      [k.id, k.key, k.name || null, k.machineId || null, k.isActive === false ? 0 : 1, k.createdAt || new Date().toISOString()]
+    );
+  }
+  for (const c of data.combos || []) {
+    adapter.run(
+      `INSERT OR REPLACE INTO combos(id, name, kind, models, createdAt, updatedAt) VALUES(?, ?, ?, ?, ?, ?)`,
+      [c.id, c.name, c.kind || null, stringifyJson(c.models || []), c.createdAt || new Date().toISOString(), c.updatedAt || new Date().toISOString()]
+    );
+  }
+  for (const [alias, model] of Object.entries(data.modelAliases || {})) {
+    adapter.run(`INSERT OR REPLACE INTO kv(scope, key, value) VALUES('modelAliases', ?, ?)`, [alias, stringifyJson(model)]);
+  }
+  for (const m of data.customModels || []) {
+    const k = `${m.providerAlias}|${m.id}|${m.type || "llm"}`;
+    adapter.run(`INSERT OR REPLACE INTO kv(scope, key, value) VALUES('customModels', ?, ?)`, [k, stringifyJson(m)]);
+  }
+  for (const [tool, mappings] of Object.entries(data.mitmAlias || {})) {
+    adapter.run(`INSERT OR REPLACE INTO kv(scope, key, value) VALUES('mitmAlias', ?, ?)`, [tool, stringifyJson(mappings || {})]);
+  }
+  for (const [provider, models] of Object.entries(data.pricing || {})) {
+    adapter.run(`INSERT OR REPLACE INTO kv(scope, key, value) VALUES('pricing', ?, ?)`, [provider, stringifyJson(models || {})]);
+  }
+}
+
+function importLegacyUsage(adapter, data) {
+  if (!data || typeof data !== "object") return;
+  for (const e of data.history || []) {
+    const t = e.tokens || {};
+    adapter.run(
+      `INSERT INTO usageHistory(timestamp, provider, model, connectionId, apiKey, endpoint, promptTokens, completionTokens, cost, status, tokens, meta) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        e.timestamp || new Date().toISOString(),
+        e.provider || null, e.model || null, e.connectionId || null, e.apiKey || null, e.endpoint || null,
+        t.prompt_tokens || t.input_tokens || 0,
+        t.completion_tokens || t.output_tokens || 0,
+        e.cost || 0,
+        e.status || "ok",
+        stringifyJson(t),
+        stringifyJson({}),
+      ]
+    );
+  }
+  for (const [dateKey, day] of Object.entries(data.dailySummary || {})) {
+    adapter.run(`INSERT OR REPLACE INTO usageDaily(dateKey, data) VALUES(?, ?)`, [dateKey, stringifyJson(day)]);
+  }
+  if (typeof data.totalRequestsLifetime === "number") {
+    setMetaSync(adapter, "totalRequestsLifetime", data.totalRequestsLifetime);
+  }
+}
+
+function importLegacyDisabled(adapter, data) {
+  if (!data || typeof data.disabled !== "object") return;
+  for (const [provider, ids] of Object.entries(data.disabled)) {
+    adapter.run(`INSERT OR REPLACE INTO kv(scope, key, value) VALUES('disabledModels', ?, ?)`, [provider, stringifyJson(ids || [])]);
+  }
+}
+
+function importLegacyDetails(adapter, data) {
+  if (!data || !Array.isArray(data.records)) return;
+  for (const r of data.records) {
+    adapter.run(
+      `INSERT OR REPLACE INTO requestDetails(id, timestamp, provider, model, connectionId, status, data) VALUES(?, ?, ?, ?, ?, ?, ?)`,
+      [r.id, r.timestamp || new Date().toISOString(), r.provider || null, r.model || null, r.connectionId || null, r.status || null, stringifyJson(r)]
+    );
+  }
+}
+
+// ─── Main entry ──────────────────────────────────────────────────────────
+export async function runMigrationOnce(adapter) {
+  if (_migratedAdapters.has(adapter)) return;
+  _migratedAdapters.add(adapter);
+
+  // Capture freshness BEFORE migrations stamp _meta (otherwise we'd misclassify
+  // a brand-new DB as non-fresh once schemaVersion is written).
+  const fresh = isFreshDb(adapter);
+
+  // 1. Always run versioned migrations chain (skip-version safe)
+  const migInfo = runVersionedMigrations(adapter);
+
+  // 2. Additive sync (auto add missing columns/indexes declared in TABLES)
+  syncSchemaFromTables(adapter);
+
+  // 3. One-time legacy JSON import (only if DB was fresh on entry)
+  const alreadyImported = fs.existsSync(MIGRATED_MARKER);
+  const legacyMain = readJsonSafe(LEGACY_FILES.main);
+  const legacyUsage = readJsonSafe(LEGACY_FILES.usage);
+  const legacyDisabled = readJsonSafe(LEGACY_FILES.disabled);
+  const legacyDetails = readJsonSafe(LEGACY_FILES.details);
+  const hasLegacy = !!(legacyMain || legacyUsage || legacyDisabled || legacyDetails);
+
+  if (fresh && hasLegacy && !alreadyImported) {
+    const t0 = Date.now();
+    const backupDir = makeBackupDir("migrate-from-json");
+    for (const f of Object.values(LEGACY_FILES)) backupFile(f, backupDir);
+
+    adapter.transaction(() => {
+      importLegacyMain(adapter, legacyMain);
+      importLegacyUsage(adapter, legacyUsage);
+      importLegacyDisabled(adapter, legacyDisabled);
+      importLegacyDetails(adapter, legacyDetails);
+      setMetaSync(adapter, "appVersion", getAppVersion());
+      setMetaSync(adapter, "migratedAt", new Date().toISOString());
+    });
+
+    try { fs.writeFileSync(MIGRATED_MARKER, new Date().toISOString()); } catch {}
+    pruneOldBackups();
+    console.log(`[DB][migrate] JSON → SQLite in ${Date.now() - t0}ms | legacy JSON kept at DATA_DIR | backup: ${backupDir}`);
+    return;
+  }
+
+  if (fresh) {
+    setMetaSync(adapter, "appVersion", getAppVersion());
+    return;
+  }
+
+  // 4. App version bump → backup data.sqlite (safety net before user-side upgrade)
+  const oldVer = getMetaSync(adapter, "appVersion", null);
+  const newVer = getAppVersion();
+  if (oldVer && oldVer !== newVer) {
+    const backupDir = makeBackupDir(`upgrade-${oldVer}-to-${newVer}`);
+    try { backupFile(DATA_FILE, backupDir); } catch {}
+    setMetaSync(adapter, "appVersion", newVer);
+    pruneOldBackups();
+    console.log(`[DB][migrate] App ${oldVer} → ${newVer} | schema ${migInfo.from} → ${migInfo.to} | backup: ${backupDir}`);
+  } else if (migInfo.applied > 0) {
+    // Schema upgrade without app version bump — still backup
+    const backupDir = makeBackupDir(`schema-${migInfo.from}-to-${migInfo.to}`);
+    try { backupFile(DATA_FILE, backupDir); } catch {}
+    pruneOldBackups();
+  }
+}

package/app/src/lib/updater/updater.js

@@ -176,6 +176,29 @@ function runInstall() {
   });
 }
 
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? `open "${url}"`
+    : platform === "win32" ? `start "" "${url}"`
+    : `xdg-open "${url}"`;
+  try { spawn(cmd, { shell: true, detached: true, stdio: "ignore" }).unref(); } catch { /* ignore */ }
+}
+
+// Wait until app port is listening (server alive again), then open dashboard
+async function waitForAppAndOpenBrowser() {
+  const deadline = Date.now() + 30000;
+  while (Date.now() < deadline) {
+    const busy = await isAppPortBusy();
+    if (busy) {
+      openBrowser(`http://localhost:${appPort}/dashboard`);
+      pushLog(`[updater] app ready, opened dashboard`);
+      return;
+    }
+    await sleep(1000);
+  }
+  pushLog(`[updater] app not responding within 30s, skip browser open`);
+}
+
 function relaunchApp() {
   if (process.env.UPDATER_RELAUNCH !== "1") return;
   const cmd = process.env.UPDATER_RELAUNCH_CMD;
@@ -193,6 +216,8 @@ function relaunchApp() {
     });
     child.unref();
     pushLog(`[updater] relaunched: ${cmd} ${args.join(" ")} (pid=${child.pid})`);
+    // Wait for new app to come up, then auto-open browser so user sees the result
+    waitForAppAndOpenBrowser();
   } catch (e) {
     pushLog(`[updater] relaunch failed: ${e.message}`);
   }

package/app/src/mitm/cert/install.js

@@ -163,9 +163,55 @@ function checkCertInstalledLinux() {
   return Promise.resolve(fs.existsSync(LINUX_CERT_FILE));
 }
 
+async function updateNssDatabases(certPath, action = 'add') {
+  const certName = "9Router MITM Root CA";
+  
+  const script = `
+    if ! command -v certutil &> /dev/null; then
+      exit 0
+    fi
+    
+    DIRS="$HOME/.pki/nssdb $HOME/snap/chromium/current/.pki/nssdb"
+    
+    if [ -d "$HOME/.mozilla/firefox" ]; then
+      for profile in "$HOME"/.mozilla/firefox/*/; do
+        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
+          DIRS="$DIRS $profile"
+        fi
+      done
+    fi
+
+    if [ -d "$HOME/snap/firefox/common/.mozilla/firefox" ]; then
+      for profile in "$HOME"/snap/firefox/common/.mozilla/firefox/*/; do
+        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
+          DIRS="$DIRS $profile"
+        fi
+      done
+    fi
+
+    for db in $DIRS; do
+      if [ -d "$db" ]; then
+        if [ "${action}" = "add" ]; then
+          certutil -d sql:"$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || \\
+          certutil -d "$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || true
+        else
+          certutil -d sql:"$db" -D -n "${certName}" 2>/dev/null || \\
+          certutil -d "$db" -D -n "${certName}" 2>/dev/null || true
+        fi
+      fi
+    done
+  `;
+  
+  return new Promise((resolve) => {
+    exec(script, { shell: "/bin/bash" }, () => resolve());
+  });
+}
+
 async function installCertLinux(sudoPassword, certPath) {
   if (!isSudoAvailable()) {
     log(`🔐 Cert: cannot install to system store without sudo — trust this file on clients: ${certPath}`);
+    // Still try to update user NSS DBs even if no sudo!
+    await updateNssDatabases(certPath, 'add');
     return;
   }
   const destFile = LINUX_CERT_FILE;
@@ -173,20 +219,24 @@ async function installCertLinux(sudoPassword, certPath) {
   const cmd = `rm -f "${LEGACY_LINUX_CERT_FILE}" && cp "${certPath}" "${destFile}" && (update-ca-certificates 2>/dev/null || update-ca-trust 2>/dev/null || true)`;
   try {
     await execWithPassword(cmd, sudoPassword);
-    log("🔐 Cert: ✅ installed to Linux trust store");
+    await updateNssDatabases(certPath, 'add');
+    log(`🔐 Cert: ✅ installed to Linux trust store (${config.dir}) and user browser databases`);
   } catch (error) {
-    throw new Error("Certificate install failed");
+    throw new Error(`Certificate install failed: ${error.message}`);
   }
 }
 
 async function uninstallCertLinux(sudoPassword) {
+  // Always try to uninstall from user DBs even without sudo
+  await updateNssDatabases(null, 'delete');
+
   if (!isSudoAvailable()) {
     return;
   }
   const cmd = `rm -f "${LINUX_CERT_FILE}" "${LEGACY_LINUX_CERT_FILE}" && (update-ca-certificates 2>/dev/null || update-ca-trust 2>/dev/null || true)`;
   try {
     await execWithPassword(cmd, sudoPassword);
-    log("🔐 Cert: ✅ uninstalled from Linux trust store");
+    log("🔐 Cert: ✅ uninstalled from Linux trust store and user browser databases");
   } catch (error) {
     throw new Error("Failed to uninstall certificate");
   }

package/app/src/mitm/dbReader.js

@@ -0,0 +1,22 @@
+// CJS reader for MITM standalone process. Reads mitmAlias from JSON cache
+// at $DATA_DIR/mitm/aliases.json (synced by app from SQLite on startup + writes).
+// JSON-only: no SQLite native binding required in MITM bundle.
+const fs = require("fs");
+const path = require("path");
+const { DATA_DIR } = require("./paths");
+
+const CACHE_FILE = path.join(DATA_DIR, "mitm", "aliases.json");
+
+function readCache() {
+  try {
+    if (!fs.existsSync(CACHE_FILE)) return null;
+    return JSON.parse(fs.readFileSync(CACHE_FILE, "utf-8"));
+  } catch { return null; }
+}
+
+function getMitmAlias(toolName) {
+  const all = readCache();
+  return all?.[toolName] || null;
+}
+
+module.exports = { getMitmAlias };

package/app/src/mitm/dns/dnsConfig.js

@@ -48,6 +48,32 @@ const MAC_ANTIGRAVITY_LEGACY_SHARED_IP_PREFIXES = [
   "142.251.",
   "172.217.",
 ];
+const REQUIRED_HOST_LOOPBACKS = IS_WIN ? ["127.0.0.1"] : ["127.0.0.1", "::1"];
+
+function lineHasHostEntry(line, address, host) {
+  const trimmed = String(line || "").trim();
+  if (!trimmed || trimmed.startsWith("#")) return false;
+  const parts = trimmed.split(/\s+/);
+  return parts[0] === address && parts.slice(1).includes(host);
+}
+
+function hasHostLoopback(content, host, address) {
+  return String(content || "")
+    .split(/\r?\n/)
+    .some((line) => lineHasHostEntry(line, address, host));
+}
+
+function hostHasRequiredLoopbacks(content, host, loopbacks = REQUIRED_HOST_LOOPBACKS) {
+  return loopbacks.every((address) => hasHostLoopback(content, host, address));
+}
+
+function getMissingHostsEntries(content, hosts, loopbacks = REQUIRED_HOST_LOOPBACKS) {
+  return hosts.flatMap((host) =>
+    loopbacks
+      .filter((address) => !hasHostLoopback(content, host, address))
+      .map((address) => `${address} ${host}`)
+  );
+}
 
 /** True when `sudo` exists (e.g. missing on minimal Docker images like Alpine). */
 function isSudoAvailable() {
@@ -219,9 +245,9 @@ async function removeToolNetworkRedirect(tool, sudoPassword) {
 function checkDNSEntry(host = null) {
   try {
     const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
-    if (host) return hostsContent.includes(host);
+    if (host) return hostHasRequiredLoopbacks(hostsContent, host);
     // Legacy: check all antigravity hosts (backward compat)
-    return TOOL_HOSTS.antigravity.every(h => hostsContent.includes(h));
+    return TOOL_HOSTS.antigravity.every(h => hostHasRequiredLoopbacks(hostsContent, h));
   } catch {
     return false;
   }
@@ -235,7 +261,7 @@ function checkAllDNSStatus() {
     const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
     const result = {};
     for (const [tool, hosts] of Object.entries(TOOL_HOSTS)) {
-      result[tool] = hosts.every(h => hostsContent.includes(h));
+      result[tool] = hosts.every(h => hostHasRequiredLoopbacks(hostsContent, h));
     }
     return result;
   } catch {
@@ -250,7 +276,8 @@ async function addDNSEntry(tool, sudoPassword) {
   const hosts = TOOL_HOSTS[tool];
   if (!hosts) throw new Error(`Unknown tool: ${tool}`);
 
-  const entriesToAdd = hosts.filter(h => !checkDNSEntry(h));
+  const currentContent = fs.readFileSync(HOSTS_FILE, "utf8");
+  const entriesToAdd = getMissingHostsEntries(currentContent, hosts);
   if (entriesToAdd.length === 0) {
     log(`🌐 DNS ${tool}: already active`);
     await ensureToolNetworkRedirect(tool, sudoPassword);
@@ -260,16 +287,16 @@ async function addDNSEntry(tool, sudoPassword) {
   try {
     if (IS_WIN) {
       // Read → trim → append → atomic write (Node-side, no CLI size limit)
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const current = currentContent;
       const trimmed = current.replace(/[\r\n\s]+$/g, "");
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\r\n");
+      const toAppend = entriesToAdd.join("\r\n");
       const next = `${trimmed}\r\n${toAppend}\r\n`;
       atomicWriteHostsWin(HOSTS_FILE, current, next);
       await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
     } else {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const current = currentContent;
       const trimmed = current.replace(/[\r\n\s]+$/g, "");
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\n");
+      const toAppend = entriesToAdd.join("\n");
       const next = `${trimmed}\n${toAppend}\n`;
       // Use tee via sudo to overwrite atomically — escape single quotes in content
       const escaped = next.replace(/'/g, "'\\''");
@@ -376,4 +403,6 @@ module.exports = {
   isSudoPasswordRequired,
   checkDNSEntry,
   checkAllDNSStatus,
+  getMissingHostsEntries,
+  hostHasRequiredLoopbacks,
 };